Employee Offboarding Checklist Automation for Access Shut-Off
An employee offboarding checklist automation works like this. When a leaver is recorded in your HR system, or entered by the owner, an AI worker opens one offboarding case. It pulls every system, shared login, app and piece of equipment that person touched from your access register, and assigns each shut-off or return to a named owner. It then chases open items on a set schedule, records the time each item is confirmed, escalates anything still open to the owner, and flags contractor and third-party accounts that a standard checklist often misses. A person still performs each shut-off and handles final pay and exit paperwork.
In short
- Each leaver should become one tracked case, with every login, device and shared credential listed and owned.
- Access that stays open after a departure is common, which is why follow-up matters more than a one-off checklist.
- Contractor, service and shared accounts are the items most often left off a standard list.
- A person still performs each shut-off, collects equipment and handles final pay and exit paperwork.
- A first version usually takes about six weeks, starting with an audit of your current access.
What the service is
AiStaffo builds an AI worker that opens one offboarding case when a leaver is recorded, lists every system, shared login, app and device that person used, assigns each shut-off or return to a named owner, and keeps chasing until each item is confirmed and logged.
Who it is for
This service suits owners and operations heads at businesses of any size where, after a departure, nobody can say with confidence which accounts the person still held. It fits teams whose access is spread across email, shared drives, finance tools, customer records, vendor portals and a handful of logins that were never written down. It is also useful where contractors, agencies or other third parties work inside your systems next to employees, because those accounts are often the ones left out of a standard list.
Why a checklist alone is not enough
A 2026 survey by Sagiss, a managed security provider, asked 1,000 US adults who had left a computer-dependent job within the previous five years about the access they kept. It found that 79% still had at least one work account or access point working after their last day, and that 64% could still reach sensitive information. Of those who felt sure on their last day that everything had been closed, 78% later found access that still worked. The same survey reported that 33% of respondents said nobody at their former employer clearly owned the job of shutting off access. These are US results, not a global measure, but the gap they describe is about ownership and follow-up, which applies anywhere.
The ISO/IEC 27001:2022 standard, in Annex A control 5.18, expects access rights to be removed when employment ends, and it sets no fixed number of hours. The standard asks the organisation to define a speed it can justify. In practice, that means a documented list, a named person for each item, and a record of when each item was closed.
What is included
- One offboarding case opened from the HR record or from an owner's entry, with the leaver's start and end dates attached.
- An access register for the leaver, built from your systems, covering sign-in accounts, email, shared mailboxes, file storage, finance and CRM tools, vendor portals, devices and physical credentials such as keycards.
- A named owner and due point for every shut-off or return.
- Scheduled reminders to each owner, followed by escalation to the business owner for anything still open.
- A timestamped confirmation log for each item, so the case can be shown to an auditor or a manager later.
- Flags for contractor, agency and third-party accounts, and for service accounts, API keys and shared passwords the leaver knew.
- A closing summary that lists every item, its owner and its confirmation time.
How it runs
The work moves through five stages. Each stage ends with a decision from you, so the build matches how your business actually works.
- Audit. We review who joins, who leaves, which systems hold company data, and where access is granted today. The output is a list of every access point, with its current owner.
- Process map. We draw the offboarding path from the moment a leaver is recorded to the last confirmed item. You approve who owns each step and how long each owner has.
- Build. We connect the HR record or owner entry to the case, set up the access register, and configure reminders, escalations and the confirmation log. Connections depend on which systems offer a way for the AI worker to read or post data; where a system offers none, the item becomes a task for a named person.
- Run. The AI worker operates the case for every leaver, chases open items, and escalates overdue ones. Your owners perform the shut-offs and mark them done.
- Support. We review the logs with you, adjust reminder timing and owners as staff and systems change, and add new systems to the register.
Where the access usually hides
A standard checklist tends to cover the main login and the laptop. The items below are the ones that most often stay open, and the ones this service is built to list.
| Access type | Examples | What is commonly missed |
|---|---|---|
| Shared logins and vaults | Team admin accounts, shared password vault entries, vendor portal logins | Passwords the leaver knew, which need changing rather than just disabling |
| Shared files and calendars | Shared drives, shared mailboxes, team calendars | Access that stays after the main account is closed. In the 2026 Sagiss survey, a quarter of former staff still had shared file access |
| Service and API keys | Integration tokens, automation accounts, developer keys | Keys issued in the leaver's name that keep working for other systems |
| Contractor and agency accounts | Third-party logins, vendor-held accounts, temporary contractor identities | Accounts that sit outside the staff list and have their own end dates |
| Devices and physical items | Laptops, phones, keycards, keys, parking passes | Items that are returned without the matching digital accounts being closed |
What the client provides
- A current list of systems that hold company data, even if it is incomplete.
- Access to the HR system or a way to send leaver details, such as a standard form.
- Named owners for finance, IT, facilities and each business system, with a backup for each.
- Your rules on who may keep access after a leaver goes, and who approves exceptions.
- Read access to the systems you want connected, and the right to make changes where shut-offs are automated.
Typical timeline
For a first version in a business with a moderate number of systems, plan for about six weeks. The audit and process map usually take the first two weeks, the build takes weeks three and four, and live running starts in week five. Groups with many systems, several countries or heavy contractor use will take longer, because the access register is larger and each owner needs to agree to their steps.
What it does not cover
The AI worker does not perform the shut-offs itself in systems it cannot reach. A person still disables accounts where no connection exists, and a person still collects laptops, keycards and keys. The service tracks these items but does not handle them physically.
It does not calculate or pay final wages, leave balances, bonuses or benefits, and it does not prepare or sign exit paperwork. Final pay and exit documents are set by employment law in each country and by the terms of each employment contract, so a person in your HR or finance team checks them. The service also does not decide who should keep access after a departure; the owner makes that call and records it. It is not a full access review, which needs its own periodic work.
Results depend on your own figures: how many leavers you have each month, how many systems you run, and how quickly your owners respond. The free audit measures these before any build starts.
A practical starting point
Before any automation, pull the list of your last twelve leavers and check which accounts were closed, by whom, and on which day. That exercise shows where ownership is weak. It also gives the audit a clear starting point, and it tells you whether the service is worth building now.
How AiStaffo would automate this
AiStaffo would connect the HR record or owner entry to an offboarding case, then build an access register from the systems your business uses. The AI worker assigns each shut-off or return to a named owner, sends reminders on a set schedule, escalates anything still open, and logs the time each item is confirmed. Contractor, service and shared accounts are flagged so they are not missed. Your owners still carry out each shut-off, handle equipment, and deal with final pay and exit paperwork. Book a free automation audit.
Questions people ask
What does an employee offboarding checklist automation actually do?
Does the AI worker disable accounts by itself?
Why do contractor and shared accounts need separate tracking?
How quickly should access be removed after someone leaves?
Who still handles final pay and exit paperwork?
How long does it take to set up?
Book a free automation audit
Thirty minutes. We look at one process you run every week and tell you exactly what an AI worker would take off your desk, and what it would not.
